The skill's own description claimed 'ANY Felhom artifact' and 'publish', and had no ISO section —
a description asserting coverage that did not exist. Description corrected and a section added.
POINTERS, NOT COPIES. The 13-criterion release gate stays in
documentation/runbooks/iso-release-gate.md and the measurements stay in the four spike audits;
duplicating them into a skill guarantees drift (the R-94/R-128 class). What the skill adds is the
ROUTING that was missing: nothing told anyone the gate exists, which is R-29's exact shape.
Records the two modes (--release public vs --pairing appliance) because picking the wrong one ships
the wrong product, the build and publish commands (rclone env-only, so no credential file is ever
written), and the round-trip verification.
The traps it carries existed only in commit messages until now, and each cost a wrong diagnosis:
- 'qm set --scsi0 ... --boot order=' in ONE call silently yields boot: order=net0;ide2
- after install the CD must be detached, or a COMPLETED install looks exactly like a stuck one
- verify focus by screendump before every Enter (GTK Enter lands in fields, not Next)
- proof installs register appliances; the verb is POST /appliances/<id>/discard, not /delete
- scratch storage at the /mnt/nvme-1tb ROOT (a subdirectory reads disconnected forever)
Also flags that the ISO gate is NOT wired into repo_gates.py, so nothing reminds you to run it.
Docs only. python3 scripts/repo_gates.py --fast: all gates OK (rc=0).
felhom-pve joins the tailnet as a host package (100.70.170.35, expiry
disabled); DooPlex already advertised 192.168.0.0/24 via its GitOps k3s
tailscale pod (100.107.87.53). ssh felhom-pve now targets the tailnet IP
(direct-over-LAN at home, tunnel when away); felhom-pve-lan = LAN fallback.
--accept-dns=false on the host. Host converted static->DHCP (reservation
keeps .162 at home). Measured: --accept-routes hairpins the local subnet
at home -> travel-only opt-in. PBS is offsite (own WireGuard tunnel), needs
none of this. Recorded not fixed: controller<->agent plane hard-pinned to
192.168.0.162 (agent listen_addr + guest bootstrap.json) -> not yet portable
off-LAN. No code changed. Full doc: documentation/operations/tailscale.md
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XMForrE4c1wZxd9LukxYVt
admin